SymfonyCon has been a fantastic experience, especially for the opportunity to meet so many incredible people for the first time. Our live discussions have already yielded tangible results. After PHPUnit, GrumPHP is now including a composer.lock for achieving total reproducibility.
This underscores the importance of the social aspect in our work, it's crucial and should never be underestimated.
PHPUnit 8.5.35, PHPUnit 9.6.14, and PHPUnit 10.5.0 are the first versions of PHPUnit where composer.lock is under version control and part of the (signed, of course) release tag.
The PHAR binary of PHPUnit now has a --composer-lock CLI option that prints the composer.lock that was used to build the PHAR.
Making the build of PHPUnit's PHAR reproducible is another step towards a more secure #PHP#SoftwareSupplyChain.
PHPUnit will soon ship a composer.lock file ! The road to more reliable and reproducibility software in the PHP ecosystem is improving, step by step, piano piano !!